On Mon, Jun 01, 2009, Matt Harrington wrote: ...
I should have been more precise in my original post. After a second read, I see that it sounds like I was asking for policy advice. Actually, what I meant to ask was is it expected behavior that "lchsh" fails for LDAP users? If so, what are my choices for allowing users to change their shells? I can open up the permissions on /etc/default/useradd, but maybe there's a better way. I need this capability.
"chsh" works for local users, so it's not that CentOS takes a stand against users changing their shells.
I think it was chsh that had a major security problem a while back that would permit user's to change their uid to ``0'' with the expect bad results. I ran into this on a SuSE system where chsh was called from usermin.
Bill